wangjia
c92cd11cc5
新增 .gitea/workflows/ci.yml 五个 Job：
1. lint — shellcheck -S warning 扫描全部 deploy/ shell 脚本
2. unit-test — docker-compose config 语法校验 + nginx -t（桩证书）
3. openapi-check — openapi-spec-validator 验证 design/server/openapi.yaml
4. redline-scan — ci/scan-redline.sh 扫描 UI 文案红线词（design/ jsx/dart/html）
5. image-build — docker build pangolin-edge:ci
附带：
- ci/scan-redline.sh：脱敏扫描脚本，过滤注释行与外部渠道 handle
- ci/nginx-test.sh：自签桩证书 + nginx -t，CI 免依赖真实 Let's Encrypt
- design/server/openapi.yaml：依据 ARCHITECTURE.md §3 展开的 OAS 3.0 完整契约
- dparts.jsx / parts.jsx：修复 killSwitchSub EN 文案「the VPN drops」红线词
→ 改为「connection drops」（行为描述，不提产品类别）
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
47 lines
1.7 KiB
Bash
47 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
# nginx-test.sh — CI 环境下校验 nginx 配置，用自签桩证书代替真实 Let's Encrypt 证书。
|
|
# 依赖: docker、openssl
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
CERT_DIR="$(mktemp -d)"
|
|
|
|
cleanup() {
|
|
rm -rf "$CERT_DIR"
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
echo "→ 生成自签桩证书 ..."
|
|
|
|
# 三个需要证书的域名
|
|
for domain in vpn.51yanmei.com blog.51yanmei.com jiu.51yanmei.com; do
|
|
mkdir -p "${CERT_DIR}/live/${domain}"
|
|
openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:P-256 -days 1 \
|
|
-keyout "${CERT_DIR}/live/${domain}/privkey.pem" \
|
|
-out "${CERT_DIR}/live/${domain}/fullchain.pem" \
|
|
-subj "/CN=${domain}" 2>/dev/null
|
|
done
|
|
|
|
# options-ssl-nginx.conf 桩（nginx -t 仅检查文件可读，不校验内容）
|
|
printf '# stub\n' > "${CERT_DIR}/options-ssl-nginx.conf"
|
|
|
|
# ssl-dhparams.pem 桩（生成 512-bit DH，足够 nginx 解析，CI 不要求安全强度）
|
|
openssl dhparam -out "${CERT_DIR}/ssl-dhparams.pem" 512 2>/dev/null
|
|
|
|
# 桩目录（nginx alias/root 在 -t 时不校验是否存在，但 volume 挂载需目录存在）
|
|
mkdir -p "${CERT_DIR}/jiu/images" "${CERT_DIR}/jiu/web" "${CERT_DIR}/jiu/marketing"
|
|
mkdir -p "${CERT_DIR}/www-pay"
|
|
|
|
echo "→ 运行 nginx -t ..."
|
|
|
|
docker run --rm \
|
|
-v "${REPO_ROOT}/deploy/edge/nginx.conf:/etc/nginx/nginx.conf:ro" \
|
|
-v "${REPO_ROOT}/deploy/edge/stream.conf:/etc/nginx/stream.conf:ro" \
|
|
-v "${REPO_ROOT}/deploy/edge/conf.d:/etc/nginx/conf.d:ro" \
|
|
-v "${CERT_DIR}:/etc/letsencrypt:ro" \
|
|
-v "${CERT_DIR}/jiu:/opt/jiu:ro" \
|
|
-v "${CERT_DIR}/www-pay:/var/www/pay:ro" \
|
|
nginx:1.27-alpine nginx -t
|
|
|
|
echo "✅ nginx 配置校验通过。"
|